[cherrchen]

Summary

Extends the verified compatibility range from 0.2.2-rc.1 to the upstream tag dsh-v0.2.2-rc.2, the current 0.2.2 release candidate. The development pin and committed lockfile stay on 0.2.0-rc.2.

This PR is a draft because the 0.2.2-rc.2 npm packages are not published yet. The GitHub Release exists (2026-11-11) but @deepseek-ai/dsh@0.2.2-rc.2 is absent from the registry (latest is still 0.2.2-rc.1), so the isolated lane cannot install the host and the compatibility matrix lane for this version stays red until publication. The declaration and the code adaptation are ready; the lane evidence is not.

Interface review (upstream tags)

• dsh-v0.2.2-rc.1 (66491b05e3) → dsh-v0.2.2-rc.2 (ddac96760b): 4645 files changed in the tree; the directories this plugin consumes contain 1001 changed files. This is a real feature release (menu positioning and submenus, session history paging and retry, worktree archive cleanup, Forge and Agent Team panels), not a version-only republish. No packages were added or removed between the tags.

The packages this plugin consumes were checked against its actual seams:

Seam	Result
Menu anchoring	Breaking for this plugin. dsh-client-ui-primitives removes Menu.getAnchorRect and the useAnchoredPosition / AnchoredPositionOptions exports; portal menus now use CSS Anchor Positioning via anchorRef / anchorPoint (upstream upgrade guide v0.2.2-alpha.2/css-anchored-menus).
Other client seams	Additions only: hoc slot kind and renderer layers, conversation.hero.frame, composer file-intake route, insertQuote(text, summary?), openSettings(sectionId?), Modal.tone, QuotePreview.summary, new icons. The slots and props Git registers or reads keep their contracts.
Host Git / subprocess	Error types move to dsh-subprocess/error.ts (SubprocessError, stable codes); a pre-aborted spawn now throws AbortError and empty argv throws SUBPROCESS_INVALID_ARGV. resolveExecutable, spawn, CollectedOutput and platform rejections are unchanged.
Credentials / directory / worktree	CredentialInfo.masked added (optional) — the DeepSeek account provider rewrite stays host-internal; WorkingDirectoryError codes and a working-directory/access waterfall, get / set unchanged; worktree archive cleanup records plugin:worktree/created but create(agent, request, signal) is unchanged; dsh-fs adds FS_ALREADY_EXISTS / fsErrorFromErrno only, resolve / lstat / writeText unchanged.
Agent / Session / LLM	AgentRegistry drops parentAgent, isOwnedBy, roots() (Git only calls agents.get). Session snapshots gain history fields; SessionSummary.cwd / projectionValues unchanged. LlmError codes are tightened; stream text-delta / GenerateOptions unchanged.
Shared runtime	Cordis 4.1.0, cosmokit 1.9.0, schemastery 3.19.0 — the same copies as 0.2.2-rc.1, already inside the declared ranges. No new OR clause.

Adaptation

• Menu anchoring. src/compat/dsh-menu.tsx adds AnchoredMenu, which supplies the anchor input the installed release reads. The probe asks whether the installed Menu still reads the removed getAnchorRect: 0.2.2-alpha.3 through rc.1 also use an internal anchorRef option in their positioning hook, so the newer prop's presence alone misidentifies those releases (the first matrix run caught exactly that). src/client/details/CommitRegion.tsx now hands over the chevron's ref instead of a measuring callback. The other four Git menus render their trigger inline, so they need no anchor input.
• Declarations. 0.2.2-rc.2 is added to SUPPORTED_DSH_RELEASES, CREDENTIALS_SEAM_DSH_RELEASES, every DSH peer OR and engines.dsh.
• CI. The 0.2.2-rc.2 lane joins the other 0.2.2 hosts on Node 24.9.0.
• Not added to peer OR. No new packages exist in this release; nothing was added.

Validation

Development pin 0.2.0-rc.2:

• pnpm compat:check — list, peer ORs, engines.dsh, dev pins and installed packages agree.
• pnpm test — 1047 passed (1043 before; 4 new).
• pnpm docs:check — passes.
• pnpm build and pnpm test:artifact — 7 artifact checks pass; the packed tarball contains the compat module and type declaration.
• pnpm pack — produces dsh-electron-dsh-plugin-git-0.2.9.tgz.
• New tests/dsh-menu.client.spec.tsx covers both anchor shapes as pure functions and asserts per installed host that the portal list lands on the supplied trigger rect (legacy branch) or publishes it as the CSS anchor (new branch). The suite was also run locally against the real published dsh-client-ui-primitives bundles of 0.1.5-rc.2 (oldest supported host) and 0.2.2-rc.1 (the release whose internal anchorRef option broke the first probe), in addition to the development pin.
• The first matrix run on this PR failed only in the new test on nine lanes (old hosts without the data-menu-material attribute, plus 0.2.2-alpha.3 / rc.1 where the probe misidentified the interface); the probe and the test selectors were corrected and re-verified as above.

The compatibility contract records the seam review and this evidence gap: docs/reference/dsh-compatibility.md.

CI results

• Compatibility matrix on this branch: all 23 previously supported exact releases pass bootstrap, upgrade, install, peers, compat, tests, docs, build, artifact and pack. The first run failed nine of them on the new test only (old hosts lacking the data-menu-material attribute, plus 0.2.2-alpha.3 / rc.1 where the probe misidentified the interface); after the fix every supported lane is green.
• verify (0.2.2-rc.2) fails at upgrade-dsh.mjs with the expected E404 No match found for version 0.2.2-rc.2.
• Main CI: macOS and Windows pass every step. Ubuntu passes install, peers check, compat:check, the full test suite and the three acceptance replays, then fails fetching Ubuntu packages for playwright install --with-deps chromium with Temporary failure resolving 'azure.archive.ubuntu.com' — a runner DNS failure unrelated to this change (identical on two runs).

Pending / not covered

• 0.2.2-rc.2 lane and browser lane: blocked on npm publication. After it is published: dispatch DSH compatibility matrix with version 0.2.2-rc.2 (candidate warn mode first), then run the formal matrix and the isolated browser lane, add the evidence to the compatibility contract, and mark this PR ready.
• No local Linux/Windows run.
• No full DSH Web/Desktop profile installation on 0.2.2-rc.2 (the host cannot be installed yet).